MS14-074: Vulnerability in Remote Desktop Protocol Could Allow Security Feature Bypass (3003743)

The remote Windows host is running Remote Desktop Protocol, which does not properly log failed logon attempts, thus allowing attackers to bypass the audit logon security feature. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid79134; scriptversion"1.7";...

CVE-2014-6318

The audit logon feature in Remote Desktop Protocol RDP in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly log unauthorized login attempts supplying valid...

Design/Logic Flaw

The audit logon feature in Remote Desktop Protocol RDP in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 does not properly log unauthorized login attempts supplying valid...

CVE-2014-6318

CVE-2014-6318 refers to a vulnerability in the Remote Desktop Protocol (RDP) audit logon feature across multiple Windows versions (Vista SP2, Server 2008 SP2/R2, 7 SP1, 8/8.1, Server 2012/2012 R2, RT/RT 8.1). The issue is that failed login attempts with valid credentials are not properly logged, ...

[SECURITY] Fedora 21 Update: freeipa-4.1.1-1.fc21

IPA is an integrated solution to provide centrally managed Identity machin e, user, virtual machines, groups, authentication credentials, Policy configuration settings, access control information and Audit events, logs, analysis thereof...

RHEL 5 : redhat-ds-base (RHSA-2012:1041)

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:1041 advisory. Red Hat Directory Server is an LDAPv3 compliant server. The base packages include the Lightweight Directory Access Protocol LDAP server and...

CVE-2014-8666

The User & Server configuration, InfoView refresh, user rights BI-BIP-ADM component in SAP Business Intellignece allows remote attackers to obtain audit event details via unspecified vectors...

Code injection

The User & Server configuration, InfoView refresh, user rights BI-BIP-ADM component in SAP Business Intellignece allows remote attackers to obtain audit event details via unspecified vectors...

Web Auditing Framework: GoLismero

GoLismero is an open source framework for security testing. It’s currently geared towards web security, but it can easily be expanded to other kinds of scans. Features: Real platform independence. Tested on Windows, Linux, BSD and OS X. No native library dependencies. All of the framework has bee...

CVE-2014-8528

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

Design/Logic Flaw

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

CVE-2014-8528

McAfee Network Data Loss Prevention NDLP before 9.3 logs session IDs, which allows local users to obtain sensitive information by reading the audit log...

Facebook to Double Bounty Payouts For Ad Code Bugs

Popular segments of Facebook code have plenty of white—and black hats—poking around for bugs. The same probably cannot be said for the social network’s ads code, so Facebook has decided to add an incentive to its bug bounty program. Through the end of the year, payments will be doubled for bugs...

openssh security, bug fix, and enhancement update

5.3p1-104 - ignore SIGXFSZ in postauth monitor child 1133906 5.3p1-103 - don't try to generate DSA keys in the init script in FIPS mode 1118735 5.3p1-102 - ignore SIGPIPE in ssh-keyscan 1108836 5.3p1-101 - ssh-add: fix fatal exit when removing card 1042519 5.3p1-100 - fix race in backported...

Wiretapping storm: the Android platform https sniffing hijacking vulnerability-vulnerability warning-the black bar safety net

0x0 Preface Last year 1 0 mid-May, Tencent Security Center in the daily terminal Safety audits found that, in the Android platform used in https communication of app the vast majority of are not safe to use the google API, a direct result of https communication of sensitive information leakage ev...

CVE-2014-5389

SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "Audited content types" option in the content-audit page to wp-admin/options-general.php...

Sql injection

SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "Audited content types" option in the content-audit page to wp-admin/options-general.php...

CVE-2014-5389

Content Audit WordPress plugin (before 1.6.1) contains a blind SQL injection in content-audit-schedule.php. An attacker can modify the Audited content types option to inject SQL that runs, e.g., via daily wp-cron, potentially exfiltrating data (e.g., password hashes). Affected versions: ≤1.6.1; r...

CVE-2014-5389

SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "Audited content types" option in the content-audit page to wp-admin/options-general.php...

Bugzilla multiple security issues

Bugzilla Security Advisory Unauthorized Account Creation An attacker creating a new Bugzilla account can override certain parameters when finalizing the account creation that can lead to the user being created with a different email address than originally requested. The overridden login name cou...